DMARC validation failed - header_from: faunalia.it

[pcav]

We are receiving reports of failed DMARC validations for emails sent by 140.211.15.3 (osgeo6.osgeo.osuosl.org) with the following identifier:

<header_from>faunalia.it</header_from>
<envelope_from>lists.osgeo.org</envelope_from>

Some examples of the reports:

<?xml version="1.0"?>	
<feedback>	
  <report_metadata>	
    <org_name>Verizon Media</org_name>	
    <email>dmarchelp@verizonmedia.com</email>	
    <report_id>1631582081.170348</report_id>	
    <date_range>	
      <begin>1631491200</begin>	
      <end>1631577599</end>	
    </date_range>	
  </report_metadata>	
  <policy_published>	
    <domain>faunalia.it</domain>	
    <adkim>r</adkim>	
    <aspf>r</aspf>	
    <p>none</p>	
    <pct>100</pct>	
  </policy_published>	
  <record>	
    <row>	
      <source_ip>140.211.15.3</source_ip>	
      <count>1</count>	
      <policy_evaluated>	
        <disposition>none</disposition>	
        <dkim>fail</dkim>	
        <spf>fail</spf>	
      </policy_evaluated>	
    </row>	
    <identifiers>	
      <header_from>faunalia.it</header_from>	
    </identifiers>	
    <auth_results>	
      <dkim>	
        <domain>faunalia.it</domain>	
        <selector>mail</selector>	
        <result>permerror</result>	
      </dkim>	
      <spf>	
        <domain>lists.osgeo.org</domain>	
        <result>pass</result>	
      </spf>	
    </auth_results>	
  </record>	
</feedback>	

<?xml version="1.0" encoding="UTF-8" ?>
<feedback>
  <version>1.0</version>
  <report_metadata>
    <org_name>esa3.hc726-32.eu.iphmx.com</org_name>
    <email>MAILER-DAEMON@esa3.hc726-32.eu.iphmx.com</email>
    <extra_contact_info></extra_contact_info>
    <report_id>803ff8$ba13321=3cf9959c31e36f60@esa3.hc726-32.eu.iphmx.com</report_id>
    <date_range>
      <begin>1631484004</begin>
      <end>1631570403</end>
    </date_range>
  </report_metadata>
  <policy_published>
    <domain>faunalia.it</domain>
    <adkim>r</adkim>
    <aspf>r</aspf>
    <p>none</p>
    <sp>none</sp>
    <pct>100</pct>
  </policy_published>
  <record>
    <row>
      <source_ip>140.211.15.3</source_ip>
      <count>1</count>
      <policy_evaluated>
        <disposition>none</disposition>
        <dkim>fail</dkim>
        <spf>fail</spf>
      </policy_evaluated>
    </row>
    <identifiers>
      <header_from>faunalia.it</header_from>
      <envelope_from>lists.osgeo.org</envelope_from>
    </identifiers>
    <auth_results>
      <dkim>
        <domain>faunalia.it</domain>
        <selector>mail</selector>
        <result>permerror</result>
      </dkim>
      <spf>
        <domain>lists.osgeo.org</domain>
        <scope>mfrom</scope>
        <result>pass</result>
      </spf>
    </auth_results>
  </record>
</feedback

<?xml version="1.0"?>
<feedback>
        <version>1.0</version>
        <report_metadata>
                <org_name>Fastmail Pty Ltd</org_name>
                <email>reports@fastmaildmarc.com</email>
                <extra_contact_info>https://fastmail.com/</extra_contact_info>
                <report_id>524846272</report_id>
                <date_range>
                        <begin>1631491200</begin>
                        <end>1631577599</end>
                </date_range>
        </report_metadata>
        <policy_published>
                <domain>faunalia.it</domain>
                <aspf>r</aspf>
                <p>none</p>
                <sp>none</sp>
                <pct>100</pct>
                <fo>0</fo>
        </policy_published>
        <record>
                <row>
                        <source_ip>140.211.15.3</source_ip>
                        <count>1</count>
                        <policy_evaluated>
                                <disposition>none</disposition>
                                <dkim>fail</dkim>
                                <spf>fail</spf>
                                <reason>
                                        <type>trusted_forwarder</type>
                                        <comment>Policy ignored due to local white list</comment>
                                </reason>
                        </policy_evaluated>
                </row>
                <identifiers>
                        <envelope_from>lists.osgeo.org</envelope_from>
                        <header_from>faunalia.it</header_from>
                </identifiers>
                <auth_results>
                        <dkim>
                                <domain>faunalia.it</domain>
                                <selector>mail</selector>
                                <result>fail</result>
                                <human_result>fail (message has been altered)</human_result>
                        </dkim>
                        <spf>
                                <domain>lists.osgeo.org</domain>
                                <scope>mfrom</scope>
                                <result>pass</result>
                        </spf>
                </auth_results>
        </record>
</feedback>

Right now we have a "none" DMARC policy, but we are planning on enforcing it in the near future. As far as I can understand, Osgeo misconfigured the headers. If I'm not wrong, this could be a problem for many other domains, so I thought it is of general interest and worth fixing.

Thanks for any intervention.

[robe]

Is this for mail coming via mailing lists. I recall we had this issue and we put in changes so mailing lists can fix this themselves. If it is coming from mailing list can you be specific as to the mailing lists? If it is some other mail e.g gitea or trac please let us know.

[pcav]

Thank you. Yes, as far as I can tell they are coming from lists.osgeo.org.

[robe]

You know which lists? I think it would be specific to the list as each list has it's own settings. Take a look at #2475

[pcav]

We don't have any definitive evidence at this point, but we think that it could be the lizmap list.

[pcav]

I think the problem is rather serious, as it may trigger rejection of valid messages from other domains. We're available for more testing and action if we can be useful.

[robe]

Is it just lizmap list you have trouble with? The lizmap admin if that list should be taking care of that.

[pcav]

AFAIK yes

[strk]

Ticket retargeted after milestone closed

[robe]

Going to close this out. I think it's a misconfigured mailing list so requires mailing list admins to handle.

[pcav]

is there a specific bugtracker for mailing lists? Thanks.

[robe]

No each mailing list admin manages their own mailing list. So I'm assuming whoever is managing lizmap needs to be informed and configure their dmarc_moderation_action to "munge from" as discussed in.

#2475

[strk]

I guess lizmap-owner should be informed